CVE-2026-21733

HighCVSS 7.3/10Last modified Oct 26, 2026

Description

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and files.

This is caused by improper handling of GPU memory reservation protections.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-280 CWE-20

Affected software

Vendor	Product	Versions
Imagination Technologies	Graphics DDK	1.18 RTM; 23.2 RTM; >= 24.1 RTM, <= 24.2 RTM; >= 25.1 RTM, <= 25.3 RTM

References

https://www.imaginationtech.com/gpu-driver-vulnerabilities/Vendor Advisory

Timeline

Published: Apr 17, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-217347.7A web page that contains unusual GPU shader code is loaded into the GPU compiler process and can trigger a write out-of-bounds write crash i CVE-2026-217364.4Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user CVE-2026-21749.8A security flaw has been discovered in code-projects Contact Management System 1.0. This affects an unknown part of the component CRUD Endpo CVE-2026-217414.8An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, For CVE-2026-217426.5A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through CVE-2026-217437.2A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenti CVE-2026-21757.2A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420618 of the file /goform/set_upnp. T CVE-2026-217517.4HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise CVE-2026-217527.5HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the sy CVE-2026-217534.2HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious t CVE-2026-217545.4HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement CVE-2026-217555.3HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attack